He's talking about skipping CORS by using a "plain" request. Avoiding CORS is not a huge security vulnerability afaik.